[kmjtechno]

Purpose

VPS_COMMIT_MISMATCH is intentionally a hard failure, but current CI omits the actual full-SHA pair. This makes the signed-runtime/source divergence hard to diagnose without privileged host inspection.

Change

• Preserve strict 40-hex deployed commit validation and existing fail-closed mismatch behavior.
• Attach expectedCommit and observedCommit only if both are valid full commit SHAs; emit bounded, credential-free KMJ_VPS_MCP_COMMIT_EXPECTED and KMJ_VPS_MCP_COMMIT_OBSERVED after the FAIL marker.
• Add regression assertions for valid mismatches and suppression of arbitrary untrusted expected environment strings.

Gates

Exact base aba3f7995ef40d0d2552145af046fd9a90806db2; final head c8b18c232edf68f67d866007193a77d9308c43d0. Await exact-head Linux/Windows CI and independent review. This is SOURCE-ONLY: it does not relax smoke, sign/deploy code, start a worker, change gateway/agent, or authorize root. Production remains blocked pending owner-held STABLE signing and guarded canary/rollback.

[kmjtechno]

Exact-head source review, 2026-10-31 UTC: inspected both changed-file patches and full scripts/verify-vps-catalog.mjs at c8b18c2. FULL_SHA is anchored /^[a-f0-9]{40}$/; mismatch remains a hard VPS_COMMIT_MISMATCH failure with process.exitCode=1. Expected/observed diagnostics print only after both values are validated full SHAs; invalid env strings are not echoed. Regression tests cover valid and invalid expected inputs. Exact-head 10/10 checks and 2/2 workflows PASS (41155238927, 41155229092). No blocking source defect found in this limited patch. This is diagnostics-only, NOT a signed runtime parity repair or authorization to deploy. Preserve normal branch review/protection, trusted owner STABLE signing and canary/rollback gates.